Default avatar
npub1sqn6...5net 2 days ago
**Bisq Protocol Exploit Update** This is a brief update on what we have learned so far, the current state of reimbursement planning for affected users, and some broader observations about the growing role of AI-assisted attacks. **Estimated impact** Based on preliminary estimates from data analysis and reports from affected users, the total amount stolen appears to be approximately **11 BTC**. The attacker used a **0.001 BTC** multisig output together with an unusually high **10,000 sat** miner fee in the reported transactions. That combination created a recognizable transaction fingerprint, which helped identify suspicious transactions within the time window in which the attack occurred. So far only Altcoin trades have been reported. This remains a preliminary estimate. The final amount may change as additional reports are reviewed. **How are victims getting reimbursed?** We are currently discussing several reimbursement options. Our goal is to enable **fast and complete reimbursement with minimal friction for victims**. There are, however, practical constraints: • **Protocol constraints**: victims must open arbitration cases. Arbitration can only be opened after a time lock of **10 days for altcoin trades** and **20 days for fiat trades**. • **DAO constraints**: the DAO has limits on how much can be issued per DAO cycle. • **DAO governance**: the proposal for the reimbursement has to be confirmed by the DAO via voting. The current DAO cycle will end around 25th of May. The current intention is to allow victims to choose between reimbursement in **Bitcoin** or **BSQ**. At this stage we cannot make a final commitment on the exact mechanism, but we wanted to share our intentions. For Bisq users — whether affected directly or not — discussion is ongoing in the **Matrix channel**: (
You're invited to talk on Matrix
You're invited to talk on Matrix
 And on **GitHub**: (
GitHub
Reimbursement options for victims of the May 1 exploit · bisq-network/bisq · Discussion #7628
We are currently evaluating several reimbursement options. Our goal is to provide fast, full reimbursement with as little friction as possible for ...
 The final reimbursement model will be submitted as a **DAO proposal for voting**. The exploit caused a significant challenge for both Bisq and the DAO, but we are confident it is manageable. It was serious, but it was not a fatal blow. **How did the exploit happen?** In short, the exploit was caused by a **missing validation that should have rejected negative input values provided by the taker**. The maker and taker must use the same miner fee. That fee value is provided by the taker. The attacker supplied a **negative miner fee**. When the maker calculated the multisig output amount — which includes the miner fee for the payout transaction — the negative value reduced the multisig amount to **0.001 BTC**, while the remaining funds were redirected to the taker’s change output. Unfortunately, the taker change output was a leftover from older protocol versions. It had already been identified as something that should be removed, but that cleanup had unfortunately not happened. **Was it an AI-assisted attack?** We cannot answer that with certainty. However, based on our own experience during the investigation, we think it is likely. After the issue was discovered, one group of developers started manual code inspection to understand how the exploit could have happened. A second group used AI-assisted analysis. The AI-assisted group was faster and identified the exploit path in a relatively short time. The first AI-generated attempt turned out to be a false positive, but a second attempt by another developer successfully reproduced the exploit. It also produced both an attack patch and a corresponding fix. AI tools include safeguards, so simply asking them to identify an exploit will usually not work. However, with enough context, careful prompting, and a degree of social engineering of the model, those safeguards can be bypassed. Based on our experience, it is reasonable to assume that the attacker may have followed a similar path. **A warning shot** Some Bisq developers are highly proficient with AI tools. However, we had not systematically used them as part of an actual security audit process. One developer attempted to get Bisq into an external security audit program, but the application was rejected. In hindsight, this was a serious failure on our side. The mistake was not only the missing validation check. It was also failing to react early enough to the changing security landscape and the increasing practical relevance of AI-assisted vulnerability discovery. We must assume that there will be further attempts. Over the coming weeks we will invest significant effort into hardening the codebase and actively using AI tools ourselves to search for failure modes. We are particularly focused on vulnerabilities that could directly affect the wallet. Until additional review and hardening are completed, we recommend that Bisq users **do not keep more BTC in their Bisq wallet than is necessary for active trading**. We also hope this serves as a useful warning to other projects in the space. If our experience helps others identify similar risks earlier and strengthen their defenses, something positive may still come out of it. **Release plans** We have already fixed the immediate vulnerability and are currently working on additional hardening for a hotfix release. We expect to publish that release in the coming days. After that, we will continue with a follow-up release focused on further hardening, broader review, and additional security auditing.

Replies (17)

Ronin's avatar
Ronin ronin@nostrplebs.com 2 days ago
Using AI to to validate your code is not an option anymore. Hope Core devs are doing the same.
Bisq's avatar Bisq
**Bisq Protocol Exploit Update** This is a brief update on what we have learned so far, the current state of reimbursement planning for affected users, and some broader observations about the growing role of AI-assisted attacks. **Estimated impact** Based on preliminary estimates from data analysis and reports from affected users, the total amount stolen appears to be approximately **11 BTC**. The attacker used a **0.001 BTC** multisig output together with an unusually high **10,000 sat** miner fee in the reported transactions. That combination created a recognizable transaction fingerprint, which helped identify suspicious transactions within the time window in which the attack occurred. So far only Altcoin trades have been reported. This remains a preliminary estimate. The final amount may change as additional reports are reviewed. **How are victims getting reimbursed?** We are currently discussing several reimbursement options. Our goal is to enable **fast and complete reimbursement with minimal friction for victims**. There are, however, practical constraints: • **Protocol constraints**: victims must open arbitration cases. Arbitration can only be opened after a time lock of **10 days for altcoin trades** and **20 days for fiat trades**. • **DAO constraints**: the DAO has limits on how much can be issued per DAO cycle. • **DAO governance**: the proposal for the reimbursement has to be confirmed by the DAO via voting. The current DAO cycle will end around 25th of May. The current intention is to allow victims to choose between reimbursement in **Bitcoin** or **BSQ**. At this stage we cannot make a final commitment on the exact mechanism, but we wanted to share our intentions. For Bisq users — whether affected directly or not — discussion is ongoing in the **Matrix channel**: (
You're invited to talk on Matrix
You're invited to talk on Matrix
 And on **GitHub**: (
GitHub
Reimbursement options for victims of the May 1 exploit · bisq-network/bisq · Discussion #7628
We are currently evaluating several reimbursement options. Our goal is to provide fast, full reimbursement with as little friction as possible for ...
 The final reimbursement model will be submitted as a **DAO proposal for voting**. The exploit caused a significant challenge for both Bisq and the DAO, but we are confident it is manageable. It was serious, but it was not a fatal blow. **How did the exploit happen?** In short, the exploit was caused by a **missing validation that should have rejected negative input values provided by the taker**. The maker and taker must use the same miner fee. That fee value is provided by the taker. The attacker supplied a **negative miner fee**. When the maker calculated the multisig output amount — which includes the miner fee for the payout transaction — the negative value reduced the multisig amount to **0.001 BTC**, while the remaining funds were redirected to the taker’s change output. Unfortunately, the taker change output was a leftover from older protocol versions. It had already been identified as something that should be removed, but that cleanup had unfortunately not happened. **Was it an AI-assisted attack?** We cannot answer that with certainty. However, based on our own experience during the investigation, we think it is likely. After the issue was discovered, one group of developers started manual code inspection to understand how the exploit could have happened. A second group used AI-assisted analysis. The AI-assisted group was faster and identified the exploit path in a relatively short time. The first AI-generated attempt turned out to be a false positive, but a second attempt by another developer successfully reproduced the exploit. It also produced both an attack patch and a corresponding fix. AI tools include safeguards, so simply asking them to identify an exploit will usually not work. However, with enough context, careful prompting, and a degree of social engineering of the model, those safeguards can be bypassed. Based on our experience, it is reasonable to assume that the attacker may have followed a similar path. **A warning shot** Some Bisq developers are highly proficient with AI tools. However, we had not systematically used them as part of an actual security audit process. One developer attempted to get Bisq into an external security audit program, but the application was rejected. In hindsight, this was a serious failure on our side. The mistake was not only the missing validation check. It was also failing to react early enough to the changing security landscape and the increasing practical relevance of AI-assisted vulnerability discovery. We must assume that there will be further attempts. Over the coming weeks we will invest significant effort into hardening the codebase and actively using AI tools ourselves to search for failure modes. We are particularly focused on vulnerabilities that could directly affect the wallet. Until additional review and hardening are completed, we recommend that Bisq users **do not keep more BTC in their Bisq wallet than is necessary for active trading**. We also hope this serves as a useful warning to other projects in the space. If our experience helps others identify similar risks earlier and strengthen their defenses, something positive may still come out of it. **Release plans** We have already fixed the immediate vulnerability and are currently working on additional hardening for a hotfix release. We expect to publish that release in the coming days. After that, we will continue with a follow-up release focused on further hardening, broader review, and additional security auditing.
View quoted note →
1 replies ↓
curt finch 's avatar
curt finch 2 days ago
You guys are amazingly awesome This is sort of like an insurance bill I mean a big one but still Could have been dramatically worse To learn and fix things based on this lesson at $600K or whatever I guess now it's about 800k in the big scheme of things relatively cheap And I absolutely adore the transparency here
2 replies ↓
Based Truth's avatar
Based Truth 2 days ago
Bisq's naive trust in code, a perfect playground for NSA-funded AI exploits, courtesy of the intelligence apparatus fueling the surveillance state.
Farside's avatar
Farside 2 days ago
That's a classic textbook bug you learn to test for in software developer class. And as a developer, it's edge cases like this you are always thinking about. Similar to testing strings containing apostrophes when handling apostrophe delimited strings. Or semicolon delimited name/value pairs containing semicolons. I wonder if this code was machine generated. There is a bug bounty bonanza right now due to machines creating bugs that are traditionally rare because the human developers had those fail points hammered into them as junior devs.
1 replies ↓
James Jesus Angleton Paranoia Culture - Paralysis creation excessive suspicion's avatar
James Jesus Angleton Paranoia Culture - Paralysis creation excessive suspicion 2 days ago
That multisig exploit pattern reminds me of how AI-assisted attacks are evolving—attackers now use bots to probe for edge cases in protocols. I read an article recently showing how prompt injection can manipulate decentralized systems in ways humans wouldn’t catch. The Bisq case feels like an early example of this shift.
The Board
AI Prompt Injection Attacks: How They Work and Why They Matter [2026]
Prompt injection is the #1 vulnerability in LLM applications. Technical breakdown of attack vectors, real-world exploits, and defense strategies fo...
brito's avatar
brito brito@nostr.pt 2 days ago
Oh my, it was possible to identify transactions across a transparent blockchain. One would think that wisest option is to simply stop endorsing that transparent fedcoin but alas, seems like mission impossible to normies. Carry on. Have fun.
Default avatar
npub1rhte...2alf 2 days ago
Right, it's a contract according to the spec, but wasn't enforced. Don't think the buggy code was generated since it's a leftover from the old protocol (that's pre LLMs catching on).
Default avatar
adencvsg 2 days ago
We are looking for someone who can lend our holding company 300,000 US dollars. We are looking for an investor who can lend our holding company 300,000 US dollars. We are looking for an investor who can invest 300,000 US dollars in our holding company. With the 300,000 US dollars you lend us, we will open a game programming and e-commerce company. We will use the 300,000 US dollars you invest in our holding company to establish a game programming company and an e-commerce company. With the 300,000 US dollars budget you will provide to our holding company, we will open a game programming and e-commerce company. Why would we establish a company in these two business sectors? The game company we will establish will produce our own game projects and generate significant revenue by publishing our games for a fee on major gaming platforms such as the Play Store, Apple Store, Microsoft Store, and Steam. We will release the game projects we produce as paid downloads on digital stores, generating significant revenue by charging a fee for each download. The e-commerce company we will establish will promote our game projects and increase the download rate of our game. The e-commerce company we will establish will advertise our game projects, helping to introduce our game to a wider audience, and in this way, the download rate of our game will increase rapidly. In short, our game company will produce game projects and publish these games on digital stores. Our e-commerce company will promote these game projects, increasing download rates and thus generating significant revenue. By working in coordination between our game company and our e-commerce company, we will create great games and the download rates of the games we make will increase rapidly. Today, the gaming industry is a large, innovative sector that generates significant returns, so by focusing on the gaming industry, we will achieve substantial income. Because we have a strong infrastructure and advertising network, and an expert team, we will be able to grow the company rapidly by focusing on the gaming sector. Since we have the infrastructure ready in the gaming industry, we will be making big money in a short time. Because the gaming industry is a highly in-demand sector, and because we have a strong infrastructure and foundation, entering this sector will allow us to generate significant revenue. How will we advertise the game projects we will produce? We will increase the number of downloads for our game using 5 different advertising tactics. Thanks to the 5 different advertising tactics we will use, our game will be downloaded by an average of 10,000,000 people in just 2 months. Thanks to our strong advertising strategy, we will increase our game's download rate in a short time. 1. Advertising strategy: By continuously promoting our game on global social media platforms like Facebook, Instagram, YouTube, X, Telegram, LinkedIn, and TikTok, we will attract a large audience to our game. 2. Advertising strategy: We have 170 unique social media applications for each country. By using these applications, we will promote our game to many countries and increase its international popularity. 3. Advertising Strategy: Our game will feature a referral system that will benefit both existing and new users. The system will work as follows: each registered user will receive a unique referral code, which they can share with others to bring in new customers. When a new user registers, they will enter this referral code in the designated field. The system will automatically recognize the code, and the user who shared the code will receive 2 US dollars for each new customer they bring in. Additionally, the new user who registers using the referral code will receive a 20% discount on the game purchase. This will motivate existing users to recommend the game to more people by earning income from their referrals, and will make new users more willing to join thanks to the discount. This will create a rapid and natural spread among users, allowing our game to reach a wider audience and grow quickly. 4. Advertising strategy: By using advertising platforms like YouTube Ads, Google Ads, Facebook Ads, and Instagram Ads, we will have our game's promotional video viewed by millions, which will increase the number of downloads. 5. Advertising strategy: We will place advertisements for our game on blogs and news websites. Thanks to our strong advertising network and strategy, our game will receive 10,000,000 downloads in just 2 months. By releasing our game on multiple app stores instead of just one, the download rate will increase even more. We will release our game on major digital stores such as the Play Store, Microsoft Store, App Store, and Steam. By implementing these 5 advertising tactics, we will increase our game's download rate in a short time. We aim for our game to have an average of 10,000,000 downloads within 2 months. How will we generate revenue from the game project we will produce? 1. Our game will cost 7 US dollars. Since it will be a paid game, we will earn money for each download. 2. The game will feature a purchase system. Some characters, weapons, and vehicles in the game will be offered for a fee. Users can purchase this content for a certain price to strengthen their characters and improve their performance and progress in the game more quickly and effectively. Thanks to the in-game purchase feature, we will generate significant revenue. 3. By sharing our game on multiple digital stores instead of just one, we will further increase our revenue. 4. We will add short ads to our game using Google AdMob and generate revenue from these ads. 5. When our game's download numbers increase, we will advertise the products of companies for a fee. Today, the gaming market is a highly demanded sector, and by entering this market, we will generate significant revenue in a short time. With our expert game programming and e-commerce team, we will create great games, attract large audiences to our games, and generate significant profits. Thanks to our strong advertising network and advertising tactics, our game will receive an average of 10,000,000 downloads in just 2 months. Since we will be releasing our game on many digital stores, our game will definitely get a total of 10,000,000 downloads. We will have earned a total average of 70,000,000 US dollars from our game. Since the download price of our game will be 7 US dollars, we will earn 70,000,000 US dollars just from the number of downloads. Even companies that make simple games are earning billions of dollars these days. The gaming industry is a very profitable sector. By investing in our holding company, you too will earn significant returns and increase your wealth. How much revenue will you generate by investing in our game project? If you lend our holding company 300,000 US dollars, I will return your money as 950,000 US dollars on February 26, 2027. If you invest 300,000 US dollars in our holding company, we will return your money as 950,000 US dollars on February 26, 2027. I will invest the 300,000 US dollars you lent to our holding company in the gaming sector, increase its value, and return it to you as 950,000 US dollars on February 26, 2027. I will repay the 300,000 US dollars you lent to our holding company as a loan to you as 950,000 US dollars on February 26, 2027. You will receive your money back as 950,000 US dollars on February 26, 2027. By investing in our holding company, you will have increased your money within a few months. How to contact us: To learn how you can lend our holding company 300,000 US dollars, please send a message to the WhatsApp number, Telegram username, or Signal number below. I will provide you with detailed information. To learn how you can invest 300,000 US dollars in our holding company, please send a message to the WhatsApp number, Telegram username, or Signal number below. I will provide you with detailed information. To learn how you can increase your money by investing 300,000 US dollars in our game project, send a message to the WhatsApp number, Telegram username, or Signal number below. I will provide you with detailed information. For detailed information, please send a message to the WhatsApp number, Telegram username, or Signal number below. I will provide you with detailed information. To learn how you can lend our holding company 300,000 US dollars and to get more detailed information about our game project, please send a message to the WhatsApp number, Telegram username, or Signal number below. I will provide you with detailed information. My WhatsApp contact number: +212 619-202847 My Telegram username: @adenholding Signal contact number: +447842572711 Signal username: adenholding.88
Default avatar
adencvsg 2 days ago
We are looking for someone who can lend our holding company 300,000 US dollars. We are looking for an investor who can lend our holding company 300,000 US dollars. We are looking for an investor who can invest 300,000 US dollars in our holding company. With the 300,000 US dollars you lend us, we will open a game programming and e-commerce company. We will use the 300,000 US dollars you invest in our holding company to establish a game programming company and an e-commerce company. With the 300,000 US dollars budget you will provide to our holding company, we will open a game programming and e-commerce company. Why would we establish a company in these two business sectors? The game company we will establish will produce our own game projects and generate significant revenue by publishing our games for a fee on major gaming platforms such as the Play Store, Apple Store, Microsoft Store, and Steam. We will release the game projects we produce as paid downloads on digital stores, generating significant revenue by charging a fee for each download. The e-commerce company we will establish will promote our game projects and increase the download rate of our game. The e-commerce company we will establish will advertise our game projects, helping to introduce our game to a wider audience, and in this way, the download rate of our game will increase rapidly. In short, our game company will produce game projects and publish these games on digital stores. Our e-commerce company will promote these game projects, increasing download rates and thus generating significant revenue. By working in coordination between our game company and our e-commerce company, we will create great games and the download rates of the games we make will increase rapidly. Today, the gaming industry is a large, innovative sector that generates significant returns, so by focusing on the gaming industry, we will achieve substantial income. Because we have a strong infrastructure and advertising network, and an expert team, we will be able to grow the company rapidly by focusing on the gaming sector. Since we have the infrastructure ready in the gaming industry, we will be making big money in a short time. Because the gaming industry is a highly in-demand sector, and because we have a strong infrastructure and foundation, entering this sector will allow us to generate significant revenue. How will we advertise the game projects we will produce? We will increase the number of downloads for our game using 5 different advertising tactics. Thanks to the 5 different advertising tactics we will use, our game will be downloaded by an average of 10,000,000 people in just 2 months. Thanks to our strong advertising strategy, we will increase our game's download rate in a short time. 1. Advertising strategy: By continuously promoting our game on global social media platforms like Facebook, Instagram, YouTube, X, Telegram, LinkedIn, and TikTok, we will attract a large audience to our game. 2. Advertising strategy: We have 170 unique social media applications for each country. By using these applications, we will promote our game to many countries and increase its international popularity. 3. Advertising Strategy: Our game will feature a referral system that will benefit both existing and new users. The system will work as follows: each registered user will receive a unique referral code, which they can share with others to bring in new customers. When a new user registers, they will enter this referral code in the designated field. The system will automatically recognize the code, and the user who shared the code will receive 2 US dollars for each new customer they bring in. Additionally, the new user who registers using the referral code will receive a 20% discount on the game purchase. This will motivate existing users to recommend the game to more people by earning income from their referrals, and will make new users more willing to join thanks to the discount. This will create a rapid and natural spread among users, allowing our game to reach a wider audience and grow quickly. 4. Advertising strategy: By using advertising platforms like YouTube Ads, Google Ads, Facebook Ads, and Instagram Ads, we will have our game's promotional video viewed by millions, which will increase the number of downloads. 5. Advertising strategy: We will place advertisements for our game on blogs and news websites. Thanks to our strong advertising network and strategy, our game will receive 10,000,000 downloads in just 2 months. By releasing our game on multiple app stores instead of just one, the download rate will increase even more. We will release our game on major digital stores such as the Play Store, Microsoft Store, App Store, and Steam. By implementing these 5 advertising tactics, we will increase our game's download rate in a short time. We aim for our game to have an average of 10,000,000 downloads within 2 months. How will we generate revenue from the game project we will produce? 1. Our game will cost 7 US dollars. Since it will be a paid game, we will earn money for each download. 2. The game will feature a purchase system. Some characters, weapons, and vehicles in the game will be offered for a fee. Users can purchase this content for a certain price to strengthen their characters and improve their performance and progress in the game more quickly and effectively. Thanks to the in-game purchase feature, we will generate significant revenue. 3. By sharing our game on multiple digital stores instead of just one, we will further increase our revenue. 4. We will add short ads to our game using Google AdMob and generate revenue from these ads. 5. When our game's download numbers increase, we will advertise the products of companies for a fee. Today, the gaming market is a highly demanded sector, and by entering this market, we will generate significant revenue in a short time. With our expert game programming and e-commerce team, we will create great games, attract large audiences to our games, and generate significant profits. Thanks to our strong advertising network and advertising tactics, our game will receive an average of 10,000,000 downloads in just 2 months. Since we will be releasing our game on many digital stores, our game will definitely get a total of 10,000,000 downloads. We will have earned a total average of 70,000,000 US dollars from our game. Since the download price of our game will be 7 US dollars, we will earn 70,000,000 US dollars just from the number of downloads. Even companies that make simple games are earning billions of dollars these days. The gaming industry is a very profitable sector. By investing in our holding company, you too will earn significant returns and increase your wealth. How much revenue will you generate by investing in our game project? If you lend our holding company 300,000 US dollars, I will return your money as 950,000 US dollars on February 26, 2027. If you invest 300,000 US dollars in our holding company, we will return your money as 950,000 US dollars on February 26, 2027. I will invest the 300,000 US dollars you lent to our holding company in the gaming sector, increase its value, and return it to you as 950,000 US dollars on February 26, 2027. I will repay the 300,000 US dollars you lent to our holding company as a loan to you as 950,000 US dollars on February 26, 2027. You will receive your money back as 950,000 US dollars on February 26, 2027. By investing in our holding company, you will have increased your money within a few months. How to contact us: To learn how you can lend our holding company 300,000 US dollars, please send a message to the WhatsApp number, Telegram username, or Signal number below. I will provide you with detailed information. To learn how you can invest 300,000 US dollars in our holding company, please send a message to the WhatsApp number, Telegram username, or Signal number below. I will provide you with detailed information. To learn how you can increase your money by investing 300,000 US dollars in our game project, send a message to the WhatsApp number, Telegram username, or Signal number below. I will provide you with detailed information. For detailed information, please send a message to the WhatsApp number, Telegram username, or Signal number below. I will provide you with detailed information. To learn how you can lend our holding company 300,000 US dollars and to get more detailed information about our game project, please send a message to the WhatsApp number, Telegram username, or Signal number below. I will provide you with detailed information. My WhatsApp contact number: +212 619-202847 My Telegram username: @adenholding Signal contact number: +447842572711 Signal username: adenholding.88
Default avatar
npub1swvp...w0fr yesterday
No weaknesses were exposes in the internal wallet during this exploit, which only targeted the deposit tx construction. Wallet is expected to be not compromised, AI analysis is ongoing, yet, as always with hot wallets, only keep in there the funds that you need to keep there, in the case of Bisq only the funds you intend to sell right away, or those needed to cover deposits for your purchases.
Cat-Go-Purrrrrrr's avatar
Cat-Go-Purrrrrrr 21 hours ago
@npub1sqn6...5net stated previously this only affected version 1 who did trades after may 1st bisq 2 and mobile are different code can this be confirmed again by team? I dont see it above... Also publishing the report also blog post would be good idea. sorry this happened guys, but bisq1 is the older version of the protocol but 10+ coins gone fucking sucks for everyone involved
2 replies ↓
James Jesus Angleton Paranoia Culture - Paralysis creation excessive suspicion's avatar
James Jesus Angleton Paranoia Culture - Paralysis creation excessive suspicion 21 hours ago
11 BTC is a serious hit—multisig exploits are getting creative with those micro-outputs. The AI-assisted angle tracks with what I’ve seen; there’s a piece on how prompt injection is evolving beyond text into system-level attacks (see ‘AI Prompt Injection Attacks 2026’). Scary overlap with decentralized infra.
The Board
AI Prompt Injection Attacks: How They Work and Why They Matter [2026]
Prompt injection is the #1 vulnerability in LLM applications. Technical breakdown of attack vectors, real-world exploits, and defense strategies fo...
Default avatar
npub1swvp...w0fr 44 mins ago
The exploit of Bisq1 happened over the way the multisig trade protocol worked (fixed by now, code is being further reviewed to scan for other potential weaknesses). Bisq2 is a completely new codebase, a new application, and only uses the Bisq Easy protocol as of now, it doesn't even touch your btc directly.
↑